list_del corruption, ffff888077fd5090->next is NULL ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:53! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 5948 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:__list_del_entry_valid_or_report+0xdf/0x190 lib/list_debug.c:52 Code: 49 39 1f 0f 85 9e 00 00 00 b0 01 5b 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc cc 48 c7 c7 a0 fc 29 8c 48 89 de e8 42 ee 63 fc 90 <0f> 0b 48 c7 c7 00 fd 29 8c 48 89 de e8 30 ee 63 fc 90 0f 0b 4c 89 RSP: 0018:ffffc90000a08d58 EFLAGS: 00010046 RAX: 0000000000000033 RBX: ffff888077fd5090 RCX: 46c8c2a7bfd7a600 RDX: 0000000000000100 RSI: 0000000000000102 RDI: 0000000000000000 RBP: 0000000000000203 R08: ffffc90000a08ae7 R09: 1ffff9200014115c R10: dffffc0000000000 R11: fffff5200014115d R12: 1ffff1100effaa12 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 000055557363e500(0000) GS:ffff888125102000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f78cb145000 CR3: 000000003452a000 CR4: 00000000003526f0 Call Trace: __list_del_entry_valid include/linux/list.h:132 [inline] __list_del_entry include/linux/list.h:223 [inline] list_del_init include/linux/list.h:295 [inline] dst_destroy+0x202/0x5a0 net/core/dst.c:163 rcu_do_batch kernel/rcu/tree.c:2617 [inline] rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869 handle_softirqs+0x22a/0x870 kernel/softirq.c:626 __do_softirq kernel/softirq.c:660 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:727 irq_exit_rcu+0x9/0x30 kernel/softirq.c:743 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:lock_acquire+0x20b/0x2e0 kernel/locking/lockdep.c:5872 Code: e9 30 ff ff ff e8 85 10 18 0a f7 c3 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 01 fe 9f 11 48 3b 44 24 30 75 33 fb 48 83 c4 38 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d 0e 5f 95 RSP: 0018:ffffc90003537520 EFLAGS: 00000292 RAX: 46c8c2a7bfd7a600 RBX: 0000000000000246 RCX: 0000000080000001 RDX: 00000000bc9ea700 RSI: ffffffff8e28c821 RDI: ffffffff8c29f960 RBP: 0000000000000000 R08: ffffffff899ca12c R09: ffffffff8fde6828 R10: ffffc90003537660 R11: fffff520006a6ed1 R12: 0000000000000000 R13: ffffffff8fde6828 R14: 0000000000000000 R15: 0000000000000001 __mutex_lock_common kernel/locking/mutex.c:614 [inline] __mutex_lock+0x19f/0x1300 kernel/locking/mutex.c:776 rx_queue_default_mask net/core/net-sysfs.c:1218 [inline] rx_queue_add_kobject net/core/net-sysfs.c:1276 [inline] net_rx_queue_update_kobjects+0x30c/0x750 net/core/net-sysfs.c:1322 register_queue_kobjects net/core/net-sysfs.c:2114 [inline] netdev_register_kobject+0x21f/0x310 net/core/net-sysfs.c:2362 register_netdevice+0x12c0/0x1cf0 net/core/dev.c:11423 __ip_tunnel_create+0x3e8/0x560 net/ipv4/ip_tunnel.c:268 ip_tunnel_init_net+0x2e7/0x840 net/ipv4/ip_tunnel.c:1147 ops_init+0x35c/0x5c0 net/core/net_namespace.c:137 setup_net+0x118/0x340 net/core/net_namespace.c:446 copy_net_ns+0x50e/0x730 net/core/net_namespace.c:581 create_new_namespaces+0x3e7/0x6a0 kernel/nsproxy.c:130 unshare_nsproxy_namespaces+0x11a/0x160 kernel/nsproxy.c:226 ksys_unshare+0x51d/0x960 kernel/fork.c:3175 __do_sys_unshare kernel/fork.c:3249 [inline] __se_sys_unshare kernel/fork.c:3247 [inline] __x64_sys_unshare+0x38/0x50 kernel/fork.c:3247 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f78ca39da67 Code: 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 10 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc03ee6778 EFLAGS: 00000206 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f78ca39da67 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 RBP: 00007ffc03ee67d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 00007ffc03ee67d8 R13: 0000000000000002 R14: 00007ffc03ee69b8 R15: 0000000000000000 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__list_del_entry_valid_or_report+0xdf/0x190 lib/list_debug.c:52 Code: 49 39 1f 0f 85 9e 00 00 00 b0 01 5b 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc cc 48 c7 c7 a0 fc 29 8c 48 89 de e8 42 ee 63 fc 90 <0f> 0b 48 c7 c7 00 fd 29 8c 48 89 de e8 30 ee 63 fc 90 0f 0b 4c 89 RSP: 0018:ffffc90000a08d58 EFLAGS: 00010046 RAX: 0000000000000033 RBX: ffff888077fd5090 RCX: 46c8c2a7bfd7a600 RDX: 0000000000000100 RSI: 0000000000000102 RDI: 0000000000000000 RBP: 0000000000000203 R08: ffffc90000a08ae7 R09: 1ffff9200014115c R10: dffffc0000000000 R11: fffff5200014115d R12: 1ffff1100effaa12 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 000055557363e500(0000) GS:ffff888125102000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f78cb145000 CR3: 000000003452a000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: e9 30 ff ff ff jmp 0xffffff35 5: e8 85 10 18 0a call 0xa18108f a: f7 c3 00 02 00 00 test $0x200,%ebx 10: 0f 84 38 ff ff ff je 0xffffff4e 16: 65 48 8b 05 01 fe 9f mov %gs:0x119ffe01(%rip),%rax # 0x119ffe1f 1d: 11 1e: 48 3b 44 24 30 cmp 0x30(%rsp),%rax 23: 75 33 jne 0x58 25: fb sti 26: 48 83 c4 38 add $0x38,%rsp * 2a: 5b pop %rbx <-- trapping instruction 2b: 41 5c pop %r12 2d: 41 5d pop %r13 2f: 41 5e pop %r14 31: 41 5f pop %r15 33: 5d pop %rbp 34: c3 ret 35: cc int3 36: cc int3 37: cc int3 38: cc int3 39: cc int3 3a: 48 rex.W 3b: 8d .byte 0x8d 3c: 3d .byte 0x3d 3d: 0e (bad) 3e: 5f pop %rdi 3f: 95 xchg %eax,%ebp